added CSP header to actual response (not just meta tag in document)